Improper Access Control in lunary-ai/lunary

Vulnerability

Overview An improper access control vulnerability in lunary-ai/lunary at the latest commit (a761d83) allows an attacker to misuse auth tokens generated by the 'invite user' functionality. The attacker can invite a target email address, obtain a one-time use token from the invitation link, then retract the invite while retaining the token. This token can later be used to obtain a valid JWT token for the target user [1][2].

Attack

Vector No prior authentication is required for the initial steps; the attacker only needs the target's email address. After retracting the invitation, the token is no longer tied to the original invite but can still be processed by the system. The attacker then leverages the token to reset the target user's password, thereby taking over their account upon registration with an arbitrary organization [1][2].

Impact

Successful exploitation results in full account compromise of the target user. Since the attack circumvents normal access controls, the attacker can gain unauthorized access to any data or functionality associated with the victim's account within the lunary platform [1][2].

Mitigation

As of publication, no patch has been released for this vulnerability. Users and administrators of lunary-ai/lunary should monitor for updates from the vendor and consider restricting invitation functionality to trusted domains until a fix is available [1][2].